CVE-2026-31973 Details
Description
SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
A NULL pointer dereference vulnerability has been identified in SAMtools versions 1.17 through 1.21, as well as 1.22, 1.22.1, and 1.23. This issue arises in the 'cram-size' command, which reports on CRAM file compression efficiency. The vulnerability occurs because a necessary check for the 'cram_decode_compression_header()' function was omitted. If this function encounters an error, it can result in a NULL pointer dereference, causing the program to crash.
Users can upgrade to SAMtools versions 1.21.1, 1.22.2, or 1.23.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/03/18/12 | CVE | Mailing ListThird Party Advisory |
| https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f | [email protected] | Patch |
| https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| samtools samtools | >= 1.17, <= 1.21.1 >= 1.22, < 1.22.2 1.23 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | CVE Modified | CVE |
| Mar 18, 2026 | New CVE Received | [email protected] |